goproxy, a popular Go-based HTTP proxy, fails to enforce HTTP proxy basic authentication when processing CONNECT tunnel requests. This flaw allows an unauthenticated attacker to create a tunnel through the proxy without providing credentials. The vulnerability is a CWE-288 Authorization Bypass through User Input issue and can be leveraged to relay arbitrary TCP traffic, giving an attacker the ability to reach protected internal destinations via the proxy. The consequence is full access to destinations that otherwise require proxy authentication, undermining the security model of the proxy.

The affected product is GoProxy from the snail007 project. Versions up to and including v15.3 are impacted, as they lack proper authentication checks for CONNECT requests. Any deployment of GoProxy 15.3 or earlier that is exposed to untrusted networks or clients is vulnerable.

The CVSS score of 6.9 indicates a moderate severity. No EPSS score is provided and the vulnerability is not listed in CISA KEV, suggesting limited evidence of exploitation at this time. Nonetheless, the flaw is exploitable via a standard network connection: any client that can reach the proxy can issue a CONNECT request, bypass authentication, and open a tunnel to any target host the proxy permits. This attack requires no special privileges and can be performed by remote unauthenticated users, making it a high value target for malicious actors. The risk is amplified for deployments that expose GoProxy to the public internet or untrusted internal networks.